From 6cc668244e41677470f5e97ab0f680436ac61652 Mon Sep 17 00:00:00 2001
From: Zdenek Pytela <zpytela@redhat.com>
Date: Mon, 26 Apr 2021 22:39:43 +0200
Reference: https://github.com/fedora-selinux/selinux-policy/commit/6cc668244e41677470f5e97ab0f680436ac61652
Conflict: NA
Subject: [PATCH] Allow IPsec and certmonger to use opencryptoki services

Add to certmonger and ipsec policy interface pkcs_use_opencryptoki(),
which allow use opencryptoki. Opencryptoki implements PKCS#11
standard.

The original commit has been split in 2 parts, this is the part for ipsec.

Resolves: rhbz#1952311
---
 policy/modules/system/ipsec.te | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/policy/modules/system/ipsec.te b/policy/modules/system/ipsec.te
index 7e99f16..9d679cb 100644
--- a/policy/modules/system/ipsec.te
+++ b/policy/modules/system/ipsec.te
@@ -247,6 +247,10 @@ optional_policy(`
 	')
 ')
 
+optional_policy(`
+	pkcs_use_opencryptoki(ipsec_t)
+')
+
 ########################################
 #
 # ipsec_mgmt Local policy
-- 
1.8.3.1